GoKawiilPingCAP TiDB Cloud breach exposes 10.6TB of customer and internal data
A threat actor claims to have exfiltrated 10.6 terabytes of data from PingCAP's TiDB Cloud platform over 88 six-hourly extractions spanning nearly two months, releasing an initial 200GB tranche publicly. The alleged haul includes control-plane databases, billing and cost records, source code, Jira and CRM data, and customer details covering 180,046 tenant organisations, 403,262 emails and over 115,000 plaintext API keys.
GoKawiil's interpretation of the reporting above, not reported fact.
If accurate, the breach would undermine PingCAP's core sales pitch that its multi-tenant managed database service is secure enough for banks, gaming firms and e-commerce companies to run production workloads on. The attacker's claim of nearly two months of undetected exfiltration across multiple cloud providers suggests significant gaps in PingCAP's monitoring of its own infrastructure, though this characterization comes solely from the party releasing the stolen data. Customers whose API keys, SQL statements and server IPs were allegedly exposed could face downstream security risks if the data is further distributed.
- Attacker claims 10.6TB exfiltrated via 88 undetected six-hourly exports of PingCAP's production control plane
- Alleged exposed data includes 115,308 plaintext API keys, 403,262 emails and 180,046 tenant organisations
- Breach claim spans PingCAP's AWS, GCP, Jira and CRM systems, raising questions about its cloud monitoring
Source: fulcrumsec.vg, 2026-10-20
Published there as: “PingCap TiDB Leaks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.